Study. uk . com
  1. Home
  2. All questions
  3. Question 592

CKA study material · question 592 of 1000

Why does the built-in view ClusterRole exclude Secrets?

  1. Secrets are cluster-scoped, and view is namespace-scoped
  2. Reading Secrets would expose ServiceAccount credentials and the API access they carry
  3. Secrets are served by an aggregated API server view cannot reach
  4. Encryption at rest makes the values unreadable anyway
Show the answer

Answer: B. Reading Secrets would expose ServiceAccount credentials and the API access they carry

Reading Secret contents in a namespace yields the ServiceAccount tokens there, which would let the reader act as any of those accounts — a privilege escalation the read-only role deliberately avoids.

Source: Using RBAC Authorization (Kubernetes) — Default roles and role bindings › User-facing roles

Challenge yourself on this topic → Study as cards